Fix spec violations in JSON.stringify wrt replacer array.

src/json.js

Index: src/json.js
diff --git a/src/json.js b/src/json.js
index c21e6351d45a345ca887ef1ed3ac3a7b811f3fbf..0799deadfe957f9bf598cbfc3006d25eb60e6a2b 100644
--- a/src/json.js
+++ b/src/json.js
@@ -210,6 +210,21 @@ function JSONStringify(value, replacer, space) {
   } else {
     gap = "";
   }
+  if (IS_ARRAY(replacer)) {
+    // Deduplicate replacer array items.
+    var property_list = new InternalArray();
+    var seen_properties = {};
+    var length = replacer.length;
+    for (var i = 0; i < length; i++) {
+      var item = replacer[i];
+      if (IS_NUMBER(item)) item = %_NumberToString(item);
+      if (IS_STRING(item) && !(item in seen_properties)) {

[arv (Not doing code reviews), 2014/03/04 19:54:54]

Is this correct? What about the overlapping properties from Object.prototype?
Like toString, __proto__ and others.

[arv (Not doing code reviews), 2014/03/04 20:04:23]

We are not handling IS_OBJECT correctly here.

http://people.mozilla.org/~jorendorff/es6-draft.html#sec-json.stringify

4. Else if Type(v) is Object then,
  a. If v has a [[StringData]] or [[NumberData]] internal slot, then let item be
ToString(v).

+        property_list.push(item);
+        seen_properties[item] = true;
+      }
+    }
+    replacer = property_list;
+  }
   return JSONSerialize('', {'': value}, replacer, new InternalArray(), "", gap);
 }